diff --git a/auth/auth.go b/auth/auth.go
index dc02d7d66..732404c3b 100644
--- a/auth/auth.go
+++ b/auth/auth.go
@@ -190,7 +190,7 @@ func ProtectedResourceMetadataHandler(metadata *oauthex.ProtectedResourceMetadat
 		// Set CORS headers for cross-origin client discovery.
 		// OAuth metadata is public information, so allowing any origin is safe.
 		w.Header().Set("Access-Control-Allow-Origin", "*")
-		w.Header().Set("Access-Control-Allow-Methods", "GET, OPTIONS")
+		w.Header().Set("Access-Control-Allow-Methods", "GET")
 		w.Header().Set("Access-Control-Allow-Headers", "Content-Type")
 
 		// Handle CORS preflight requests
diff --git a/auth/auth_test.go b/auth/auth_test.go
index 654ca26b8..49dd363fb 100644
--- a/auth/auth_test.go
+++ b/auth/auth_test.go
@@ -148,8 +148,8 @@ func TestProtectedResourceMetadataHandler(t *testing.T) {
 				t.Errorf("Access-Control-Allow-Origin = %q, want %q", got, "*")
 			}
 
-			if got := rec.Header().Get("Access-Control-Allow-Methods"); got != "GET, OPTIONS" {
-				t.Errorf("Access-Control-Allow-Methods = %q, want %q", got, "GET, OPTIONS")
+			if got := rec.Header().Get("Access-Control-Allow-Methods"); got != "GET" {
+				t.Errorf("Access-Control-Allow-Methods = %q, want %q", got, "GET")
 			}
 
 			// Validate error response body for disallowed methods
diff --git a/examples/server/auth-middleware/README.md b/examples/server/auth-middleware/README.md
index 001237c0c..561d05f6c 100644
--- a/examples/server/auth-middleware/README.md
+++ b/examples/server/auth-middleware/README.md
@@ -246,7 +246,7 @@ import "github.com/rs/cors"
 
 c := cors.New(cors.Options{
     AllowedOrigins: []string{"https://example.com"},
-    AllowedMethods: []string{"GET", "OPTIONS"},
+    AllowedMethods: []string{"GET"},
 })
 http.Handle("/.well-known/oauth-protected-resource",
     c.Handler(auth.ProtectedResourceMetadataHandler(metadata)))
@@ -258,7 +258,7 @@ import "github.com/jub0bs/cors"
 
 corsMiddleware, err := cors.NewMiddleware(cors.Config{
     Origins: []string{"https://example.com"},
-    Methods: []string{"GET", "OPTIONS"},
+    Methods: []string{"GET"},
 })
 http.Handle("/.well-known/oauth-protected-resource",
     corsMiddleware.Wrap(auth.ProtectedResourceMetadataHandler(metadata)))
diff --git a/internal/oauthtest/fake_authorization_server.go b/internal/oauthtest/fake_authorization_server.go
index 4cd68264a..1694f81d6 100644
--- a/internal/oauthtest/fake_authorization_server.go
+++ b/internal/oauthtest/fake_authorization_server.go
@@ -210,7 +210,7 @@ func (s *FakeAuthorizationServer) handleMetadata(w http.ResponseWriter, r *http.
 	}
 	// Set CORS headers for cross-origin client discovery.
 	w.Header().Set("Access-Control-Allow-Origin", "*")
-	w.Header().Set("Access-Control-Allow-Methods", "GET, OPTIONS")
+	w.Header().Set("Access-Control-Allow-Methods", "GET")
 	w.Header().Set("Access-Control-Allow-Headers", "Content-Type")
 
 	// Handle CORS preflight requests